Memorandum of Understanding: OPC

The IPC signed the Memorandum of Understanding below with the Office of the Privacy Commissioner of Canada (OPC) related to the administration and enforcement of the Personal Health Information Protection Act (PHIPA) and the Personal Information Protection and Electronic Documents Act (PIPEDA).

MEMORANDUM OF UNDERSTANDING BETWEEN THE OFFICE OF THE PRIVACY COMMISSIONER OF CANADA AND THE OFFICE OF THE INFORMATION AND PRIVACY COMMISSIONER OF ONTARIO ON MUTUAL ASSISTANCE IN THE ADMINISTRATION AND ENFORCEMENT OF LAWS PROTECTING PERSONAL INFORMATION

The Office of the Privacy Commissioner of Canada (“OPC”) and the Office of the Information and Privacy Commissioner of Ontario (“OIPC”) (“the Participants”):

RECOGNIZING that the OPC and OIPC have oversight responsibilities with respect to the protection of personal information in their respective jurisdictions;

RECOGNIZING that the OPC, pursuant to the Personal Information Protection and Electronic Documents Act, S.C. 2000, c. 5 (“PIPEDA”), is responsible for protecting personal information in the private sector in Canada;

RECOGNIZING that the OIPC, pursuant to the Personal Health Information Protection Act, 2004, S.O. 2004, c. 3, Sch A (“PHIPA”), is responsible for protecting personal health information in Ontario;

RECOGNIZING that PHIPA has been found to be substantially similar to PIPEDA;

RECOGNIZING that there are circumstances where the Participants may have a mutual interest in a matter pursuant to their respective mandates;

RECOGNIZING that s. 23 of PIPEDA authorizes the OPC to consult, coordinate its activities and share information with a person who, under provincial laws, has similar functions and duties with respect to the protection of personal information;

RECOGNIZING that s. 66(e) of PHIPA authorizes the OIPC to assist in investigations and similar procedures conducted by a person who performs similar functions to the OIPC under the laws of Canada, except that in providing assistance, the OIPC shall not use or disclose information collected by or for the OIPC under PHIPA;

RECOGNIZING that s. 68(3) of PHIPA permits the OIPC to disclose information in the course of exercising the OIPC’s functions under PHIPA, where the disclosure is required for the purpose of exercising those functions;

RECOGNIZING that the Participants have similar functions and duties with respect to the protection of personal information; and

RECOGNIZING the benefits of consultation, co-ordination and information sharing (where not prohibited) with respect to their mandates under PIPEDA and PHIPA;

HAVE REACHED THE FOLLOWING UNDERSTANDING:
I. Objective

The objective of this Memorandum is to establish a framework to allow the Participants to consult, co-operate and share relevant information with respect to matters arising under PIPEDA and PHIPA in which the Participants are mutually interested.

II. Procedures Relating to Mutual Assistance

A. Each Participant will designate a primary contact for the purposes of requests for assistance and other communications under this Memorandum.

B. Participants may communicate and co-operate with each other, as appropriate, about matters arising under PIPEDA and PHIPA, in which they are mutually interested.

C. Subject to Section III, the Participants may share information that could be relevant to an ongoing or potential investigation of a complaint or audit under PIPEDA or PHIPA, or that could assist the Participants in the exercise of their functions or duties with respect to the protection of personal information.

D. The Participants will notify each other, without delay, if they become aware that information shared under this Memorandum is not accurate, complete, and up-to-date.

E. Subject to Section III, Participants may, as appropriate and subject to relevant legal restrictions, refer complaints to each other, or provide each other notice of possible contraventions.

F. Participants will use their best efforts to resolve any disagreements related to co-operation that may arise under this Memorandum through the contacts designated under Section II A, and, failing resolution in a reasonably timely manner, by discussion between the heads of the Participants.

III. Limitations on Assistance and Use

A. For greater certainty, nothing in this Memorandum requires Participants to provide assistance where it is outside the scope of this Memorandum or, more generally, where it would be inconsistent with applicable laws, or important interests or priorities.

B. Participants will only share personal information pursuant to this Memorandum to the extent that it is necessary for fulfilling the purposes of this Memorandum and will use best efforts to obtain the consent of the individual(s) concerned before doing so.

C. The Participants acknowledge that nothing in this memorandum is to be construed as authorizing the OIPC to share information collected by or for the OIPC under PHIPA unless the disclosure is required for the purpose of exercising the OIPC’s own functions under PHIPA;

D. Participants will not use any information obtained pursuant to this Memorandum for purposes other than those for which the information was originally shared.

IV. Confidentiality

A. Information shared under this Memorandum is to be treated as confidential and will not be further disclosed without the consent of the Participant who provided it.

B. Each Participant will use best efforts to safeguard the security of any information received under this Memorandum and respect any safeguards agreed to by the Participants. In the event of any unauthorized access or disclosure of the information, the affected Participant will take all reasonable steps to prevent a recurrence of the event and will promptly notify the other Participant of the occurrence.

C. The Participants will oppose, to the fullest extent possible consistent with applicable laws, any application by a third party for disclosure of confidential information or materials received under this Memorandum, unless the Participant who provided the information or materials consents to its release. The Participant who receives such an application will notify forthwith the Participant that provided it with the information or materials.

V. Retention of Information

Information received under this Memorandum will not be retained for longer than is required to fulfill the purpose for which it was shared or than is required by applicable laws. The Participants will use best efforts to return any information that is no longer required if the Participant who provided the information makes a written request that such information be returned at the time it is shared. If no request for return of the information is made, the Participants will dispose of the information using methods prescribed by the Participant who provided the information, or if no such methods have been prescribed, by other secure methods as soon as practicable after the information is no longer required.

VI. Duration of Cooperation

A. This Memorandum takes effect on the date it is signed.

B. Assistance in accordance with this Memorandum will be available concerning matters occurring before as well as after this Memorandum is signed.

C. This Memorandum may be terminated at any time on written notice by either Participant. However, prior to providing such notice, each Participant will use best efforts to consult with the other Participant.

D. On termination of this Memorandum, the Participants will, in accordance with Section IV, maintain the confidentiality of any information communicated to them by the other Participant in accordance with this Memorandum, and return or destroy, in accordance with the provisions of Section V, information obtained from the other Participant in accordance with this Memorandum.

VII. Legal Effect

Nothing in this Memorandum is intended to:

A. Create binding legal obligations.

B. Create obligations or expectations of co-operation that would exceed a Participant’s jurisdiction.

Signed in duplicate in the English and French languages, each version being equally authentic.

Brian Beamish
Information and Privacy Commissioner of Ontario
At: Toronto, ON
Date: September 23, 2014

Daniel Therrien
Privacy Commissioner of Canada
At : Gatineau, QC
Date: August 15, 2014